1
$\begingroup$

In MAC forgery, is it assumed that the attacker has the secret key or not? I find this in Wikipedia but still not clear.

Existential forgery is the creation (by an adversary) of at least one message/signature pair, ( m , σ ), where σ was not produced by the legitimate signer. The adversary need not have any control over m, m need not have any particular meaning; the message content is irrelevant — as long as the pair, ( m , σ ), is valid, the adversary has succeeded in constructing an existential forgery.

$\endgroup$
4
$\begingroup$

The key part of the entry is "...where σ was not produced by the legitimate signer.". The legitimate signer is the key holder. We assume the adversary does not possess the key, but would like to have a way to produce MAC tags anyways.

$\endgroup$
1
$\begingroup$

Definition 9.7 in chapter 9 of the the online Handbook of Applied Cryptography defines MACs, and says (my boldface):

Furthermore, given a description of the function family $h$, for every fixed allowable value of $k$ (unknown to an adversary), the following property holds: [...definition of computation-resistance property...]

The following text just after the definition also doesn't make sense unless the key $k$ is secret:

If computation-resistance does not hold, a MAC algorithm is subject to MAC forgery. While computation-resistance implies the property of key non-recovery (it must be computationally infeasible to recover $k$, given one or more text-MAC pairs $(x_i, h_k(x_i))$ for that $k$), key non-recovery does not imply computation-resistance (a key need not always actually be recovered to forge new MACs).

The Handbook is a bit dated, but it's great for these basic definitions.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.